Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SunBlock: Cloudless Protection for IoT Systems

Vadim Safronov, Anna Maria Mandalari, Daniel J. Dubois, David Choffnes, Hamed Haddadi

TL;DR

SunBlock tackles IoT security and privacy risks by delivering cloudless threat detection on a home router. It fuses a rule-based filtering engine (Snort3 NFQ IPS) with an ARM-enabled AI anomaly detector (OCSVM ported via netml in a Docker container) to run entirely locally. In a realistic 10-device IoT testbed with threat emulation, SunBlock achieves broader threat coverage than popular cloud-based protections while imposing modest edge overhead and preserving normal IoT functionality. This cloudless, edge-based approach reduces privacy exposure and latency, offering a practical path to private, resilient home IoT security.

Abstract

With an increasing number of Internet of Things (IoT) devices present in homes, there is a rise in the number of potential information leakage channels and their associated security threats and privacy risks. Despite a long history of attacks on IoT devices in unprotected home networks, the problem of accurate, rapid detection and prevention of such attacks remains open. Many existing IoT protection solutions are cloud-based, sometimes ineffective, and might share consumer data with unknown third parties. This paper investigates the potential for effective IoT threat detection locally, on a home router, using AI tools combined with classic rule-based traffic-filtering algorithms. Our results show that with a slight rise of router hardware resources caused by machine learning and traffic filtering logic, a typical home router instrumented with our solution is able to effectively detect risks and protect a typical home IoT network, equaling or outperforming existing popular solutions, without any effects on benign IoT functionality, and without relying on cloud services and third parties.

SunBlock: Cloudless Protection for IoT Systems

TL;DR

SunBlock tackles IoT security and privacy risks by delivering cloudless threat detection on a home router. It fuses a rule-based filtering engine (Snort3 NFQ IPS) with an ARM-enabled AI anomaly detector (OCSVM ported via netml in a Docker container) to run entirely locally. In a realistic 10-device IoT testbed with threat emulation, SunBlock achieves broader threat coverage than popular cloud-based protections while imposing modest edge overhead and preserving normal IoT functionality. This cloudless, edge-based approach reduces privacy exposure and latency, offering a practical path to private, resilient home IoT security.

Abstract

With an increasing number of Internet of Things (IoT) devices present in homes, there is a rise in the number of potential information leakage channels and their associated security threats and privacy risks. Despite a long history of attacks on IoT devices in unprotected home networks, the problem of accurate, rapid detection and prevention of such attacks remains open. Many existing IoT protection solutions are cloud-based, sometimes ineffective, and might share consumer data with unknown third parties. This paper investigates the potential for effective IoT threat detection locally, on a home router, using AI tools combined with classic rule-based traffic-filtering algorithms. Our results show that with a slight rise of router hardware resources caused by machine learning and traffic filtering logic, a typical home router instrumented with our solution is able to effectively detect risks and protect a typical home IoT network, equaling or outperforming existing popular solutions, without any effects on benign IoT functionality, and without relying on cloud services and third parties.
Paper Structure (19 sections, 6 figures, 2 tables)

This paper contains 19 sections, 6 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Threat model
  3. System Design
  4. Rule-based Traffic Filtering Module
  5. AI-based Network Threat Detection Module
  6. Implementation
  7. Hardware
  8. Rule-based Traffic Filtering
  9. AI-based Network Threat Detection
  10. Evaluation Methodology
  11. Evaluation Testbed
  12. Threats Emulation
  13. Experiments Description and Evaluation Metrics
  14. Evaluation
  15. Performance Overheads
  16. ...and 4 more sections

Figures (6)

  • Figure 1: Threat model diagram. Victim zone is a smart home with connected IoT devices. A potential adversary can analyze traffic and conduct privacy/security attacks from smart home, ISP and wider zones, such as the Internet.
  • Figure 2: SunBlock architecture running on a home router.
  • Figure 3: Resource usage in protected vs. unprotected mode for regular IoT traffic.
  • Figure 4: ECDFs of SunBlock's prevention time per each attack.
  • Figure 5: Resource usage in protected vs. unprotected mode under DoS attacks.
  • ...and 1 more figures